Cryptosec Dekaton Non-Proprietary Security Policy Realia Technologies, S.L. Revision: 12.11.3642 Date: 14/11/2018 Revision History Revision Date Change Description 12.11.3481 09/04/2018 First Release 12.11.3642 14/11/2018 Coordination changes Realsec Non proprietary 2 Revision: 12.11.3642 Date: 14/11/2018 Contents 1 Introduction 8 1.1 Purpose 8 1.2 Approved Product Identification 8 2 Cryptosec Dekaton 9 2.1 Overview 9 2.2 Module Specification 12 2.2.1 Approved Cryptographic Algorithms in the NIST FIPS PUB 140-2-Approved mode of operation 12 2.2.2 Allowed Cryptographic Algorithms in the NIST FIPS PUB 140-2-Approved mode of operation 15 2.2.3 Cryptographic Algorithms in the Non-NIST FIPS PUB 140-2-Approved modes of operation 15 2.2.4 CSPs and other Protected Information 22 2.3 Module Interfaces 28 2.4 Roles and Services 40 2.4.1 Crypto Officer Role 41 2.4.2 User Role 42 2.4.3 Unauthenticated Services 45 2.5 Physical Security 46 2.6 Self-Tests 46 2.7 Mitigation of other Attacks 53 2.8 Rules of Operation 54 Realsec Non proprietary 3 Revision: 12.11.3642 Date: 14/11/2018 2.8.1 Secure Administration 54 2.8.2 Secure Operation 55 2.8.3 General Rules 56 2.9 Modes of Operation Management 56 2.9.1 Differences between Modes of Operation 56 2.9.2 Selecting the Mode of Operation 59 2.9.3 Reporting the Current Mode of Operation 60 A Glossary of Terms 61 Bibliography 63 Realsec Non proprietary 4 Revision: 12.11.3642 Date: 14/11/2018 List of Figures 2.1 Cryptosec Dekaton top view 9 2.2 Cryptosec Dekaton lateral view 10 2.3 External battery port Access 28 2.4 PCIe 8x standard fingers Access 30 2.5 Gigabit Ethernet ports Access 31 2.6 UART ports Access 32 2.7 USB Host port Access 33 2.8 Fan port Access 33 2.9 Tamper port Access 34 2.10 Power Present port Access 35 2.11 Currently Unsupported port Access 35 2.12 Power OK port Access 36 2.13 DDR3 Zeroization Done port Access 37 Realsec Non proprietary 5 Revision: 12.11.3642 Date: 14/11/2018 List of Tables 1.1 Approved Product Identification 8 2.1 Security requirements levels 10 2.1 Security requirements levels (continued) 11 2.2 Approved Cryptographic algorithms in the NIST FIPS PUB 140-2-Approved mode of operation 12 2.2 Approved Cryptographic algorithms in the NIST FIPS PUB 140-2-Approved mode of operation (continued) 13 2.2 Approved Cryptographic algorithms in the NIST FIPS PUB 140-2-Approved mode of operation (continued) 14 2.3 Allowed Cryptographic algorithms in the NIST FIPS PUB 140-2-Approved mode of operation 15 2.4 Cryptographic algorithms in the PCI PTS HSM v2.0-Approved mode of operation 16 2.4 Cryptographic algorithms in the PCI PTS HSM v2.0-Approved mode of operation (continued) 17 2.4 Cryptographic algorithms in the PCI PTS HSM v2.0-Approved mode of operation (continued) 18 2.5 Cryptographic algorithms in the Non-Approved mode of operation 19 2.5 Cryptographic algorithms in the Non-Approved mode of operation (continued) 20 2.5 Cryptographic algorithms in the Non-Approved mode of operation (continued) 21 2.5 Cryptographic algorithms in the Non-Approved mode of operation (continued) 22 2.6 CSPs and other Protected Information 22 2.6 CSPs and other Protected Information (continued) 23 2.6 CSPs and other Protected Information (continued) 24 Realsec Non proprietary 6 Revision: 12.11.3642 Date: 14/11/2018 2.6 CSPs and other Protected Information (continued) 25 2.6 CSPs and other Protected Information (continued) 26 2.6 CSPs and other Protected Information (continued) 27 2.7 PCIe 8x standard fingers Pin Assignment 29 2.7 PCIe 8x standard fingers Pin Assignment (continued) 30 2.8 Crypto Officer Services from the Human Interface 41 2.8 Crypto Officer Services from the Human Interface (continued) 42 2.9 User Services from the Machine Interface 43 2.9 User Services from the Machine Interface (continued) 44 2.9 User Services from the Machine Interface (continued) 45 2.10 Unauthenticated Services from the Machine Interface 45 2.11 Unauthenticated Services from the Human Interface 45 2.11 Unauthenticated Services from the Human Interface (continued) 46 A.1 Glossary of terms 61 A.1 Glossary of terms (continued) 62 Realsec Non proprietary 7 Revision: 12.11.3642 Date: 14/11/2018 Chapter 1 Introduction 1.1 Purpose Federal Information Processing Standards Publication 140-2 - Security Requirements for Cryp- tographic Modules (NIST FIPS PUB 140-2) details the U.S. Government requirements for cryp- tographic modules. More information about the NIST FIPS PUB 140-2 Standard and validation program is available on the NIST website. This is a Cryptosec Dekaton Non-Proprietary Security Policy for the Cryptosec Dekaton Hard- ware Security Module (HSM) from Realia Technologies, S.L. (Realsec). This Non-Proprietary Security Policy describes how the Cryptosec Dekaton meets the security requirements of NIST FIPS PUB 140-2 , and how to run the Cryptosec Dekaton in secure NIST FIPS PUB 140-2 mode of operation. This Non-Proprietary Security Policy was prepared as part of the Level 3 NIST FIPS PUB 140-2 validation of the module. 1.2 Approved Product Identification The following table shows the product name, hardware version, and firmware version information: Table 1.1: Approved Product Identification Part Name Hardware Version Firmware Version Cryptosec Dekaton 1.1 12.11.3642 Realsec Non proprietary 8 Revision: 12.11.3642 Date: 14/11/2018 Chapter 2 Cryptosec Dekaton 2.1 Overview The Cryptosec Dekaton is a high-end PCIe card that provides cryptographic services and secure storage of cryptographic keys. It is built to perform cryptographic processing and features a tamper-protective case to physically protect sensitive information contained within the card. Figure 2.1: Cryptosec Dekaton top view Realsec Non proprietary 9 Revision: 12.11.3642 Date: 14/11/2018 Figure 2.2: Cryptosec Dekaton lateral view The Cryptosec Dekaton is designed to provide the highest level of security; security has been incorporated into the Cryptosec Dekaton since product inception. The Cryptosec Dekaton prod- uct design, development, test and production has satisfied the requirements to ensure a secure product. Security has been the focus of the development team, and the Cryptosec Dekaton prod- uct has been designed from the ground up to incorporate security in all design and development steps. The Cryptosec Dekaton is certified to meet the NIST FIPS PUB 140-2 security requirements for the levels shown in the following table. The overall module is certified NIST FIPS PUB 140-2 Level 3. Table 2.1: Security requirements levels Security Requirement Level 1. Cryptographic Module Specification 3 2. Module Ports and Interfaces 3 3. Roles, Services, and Authentication 3 4. Finite State Model 3 5. Physical Security 3 6. Operational Environment N/A 7. Cryptographic Key Management 3 8. EMI / EMC 3 9. Self Tests 3 Realsec Non proprietary 10 Revision: 12.11.3642 Date: 14/11/2018 Table 2.1: Security requirements levels (continued) Security Requirement Level 10. Design Assurance 3 11. Mitigation of Other Attacks 3 The Cryptosec Dekaton is comprised of the module itself and the supplied drivers to access the functionality of the product. A special USB cable is also included. Realsec Non proprietary 11 Revision: 12.11.3642 Date: 14/11/2018 2.2 Module Specification 2.2.1 Approved Cryptographic Algorithms in the NIST FIPS PUB 140-2-Approved mode of oper- ation Table 2.2: Approved Cryptographic algorithms in the NIST FIPS PUB 140-2-Approved mode of operation Certs. Algorithm Standard Mode Method Key Lengths Curves Module Use #5326 AES [FIPS197] ECB, CBC, CTR 128, 192, 256 Encryption Decryption [SP800-38B] CMAC Message authentication [SP800-38D] GCM/GMAC Encryption Decryption #2688 TDES [SP800-67r1] ECB, CBC 192 Encryption Decryption [SP800-38B] CMAC Message authentication #1376 #1384 DSA [FIPS186-4] KeyGen L=2048, N=224 L=2048, N=256 L=3072, N=256 Key pair generation PQGen L=2048, N=224, SHA-224 L=2048, N=256, SHA-256 L=3072, N=256, SHA-256 Domain parameters generation SigGen Signature generation PQVer L=1024, P=160, SHA-1 L=2048, N=224, SHA-224 L=2048, N=256, SHA-256 L=3072, N=256, SHA-256 Domain parameters verification SigVer Signature verification Realsec Non proprietary 12 Revision: 12.11.3642 Date: 14/11/2018 Table 2.2: Approved Cryptographic algorithms in the NIST FIPS PUB 140-2-Approved mode of operation (continued) Certs. Algorithm Standard Mode Method Key Lengths Curves Module Use #2854 #2865 RSA [FIPS186-4] KeyGen e=fermat4, M=2048 e=fermat4, M=3072 Key pair generation SigGen X9.31 e=fermat4, M=2048, SHA-2 e=fermat4, M=3072, SHA-2 e=fermat4, M=4096, SHA-2 Signature generation SigVer X9.31 Signature verification SigGen PKCS1v1.5 Signature generation SigVer PKCS1v1.5 Signature verification SigGen PSS e=fermat4, M=2048, SHA-2, SLen=160 e=fermat4, M=3072, SHA-2, SLen=160 e=fermat4, M=4096, SHA-2, SLen=160 Signature generation SigVer PSS Signature verification #1398 #1793 (CVL) ECDSA [FIPS186-4] KeyGen P-224, -256, -384, -521 K-233, 283, -409, -571 B-233, -283, -409, -571 Key pair generation SigVer Signature verification SigGen Signature generation PubKeyVal P-192, -224, -256, -384, -521 K-163, -233, 283, -409, -571 B-163, -233, -283, -409, -571 Public key validation #1410 #1830 (CVL) ECDSA [FIPS186-4] KeyGen P-224, -256, -384, -521 Key pair generation SigVer Signature verification SigGen Signature generation Realsec Non proprietary 13 Revision: 12.11.3642 Date: 14/11/2018 Table 2.2: Approved Cryptographic algorithms in the NIST FIPS PUB 140-2-Approved mode of operation (continued) Certs. Algorithm Standard Mode Method Key Lengths Curves Module Use #1410 #1830 (CVL) ECDSA [FIPS186-4] PubKeyVal P-192, -224, -256, -384, -521 Public key validation #4278 SHS [FIPS180] - SHA-1, SHA-224, SHA-256, SHA-384 SHA-512, SHA-512/224, SHA-512/256 Data digest #3524 HMAC [FIPS198-1] KS= 128 passwordLen <= 512 Key derivation #N/A KTS-OAEP- Party V-confirmation [SP800-56Br1] - e=3, fermat4, M=512..4096 Key encapsulation #N/A RSAES-PKCS1-OAEP encryption with RSA PSS signature - Realsec Non proprietary 21 Revision: 12.11.3642 Date: 14/11/2018 Table 2.5: Cryptographic algorithms in the Non-Approved mode of operation (continued) Certs. Algorithm Standard Mode Method Key Lengths Curves Module Use #N/A CKG (Cryptographic Key Generation) [SP800-133] - - Key generation #N/A KTS (AES #N/A HMAC #N/A) [SP800-38F] AES CBC HMAC AES-256 256 Key wrapping #N/A Derived and Non-derived wrapping key methods - DES TDES AES 64 128, 192 128, 192, 256 Key wrapping Where #N/A means Not Apply. 2.2.4 CSPs and other Protected Information Table 2.6: CSPs and other Protected Information CSP Type Generation Input Output Storage Zeroization Use Mode SCCK Key AES-256 key Internally generated [SP800-133] API call: Input in plaintext shares API call: Output in plaintext shares Plaintext in secure memory -API call -Module zeroization Set up the SCP03 secure channel All Old SCCK Key Former SCCK Key Never input Never output Translation Realsec Non proprietary 22 Revision: 12.11.3642 Date: 14/11/2018 Table 2.6: CSPs and other Protected Information (continued) CSP Type Generation Input Output Storage Zeroization Use Mode AES Encryp- tion Key AES-128 AES-192 AES-256 keys API call: Internally generated [SP800-133] API calls: -Input in plaintext shares -Unencapsulated [SP800-56Br1] -Unwrapped [SP800-38F] API calls: -Output in plaintext shares -Encapsulated [SP800-56Br1] -Wrapped [SP800-38F] If stored: in NAND Flash encrypted with the System Key -API call if stored -Remove power Encryption Decryption All AES GCM/ GMAC Key AES CMAC Key MAC: generation verification AES HMAC Key HMAC: generation verification AES Wrap Key AES-256 key Wrapping Unwrapping TDES (3 key) Encryp- tion Key TDES (3 key) key Encryption Decryption TDES (3 key) CMAC Key MAC: generation verification TDES (3 key) HMAC Key HMAC: generation verification Realsec Non proprietary 23 Revision: 12.11.3642 Date: 14/11/2018 Table 2.6: CSPs and other Protected Information (continued) CSP Type Generation Input Output Storage Zeroization Use Mode SSH Key ECDSA P-521key Internally generated on boot if not exists [FIPS186-4] Never input In NAND Flash encrypted with the System Key Not zeroized Unusable when the System Key is zeroized Set up the SSH secure channel FIPS PUB 140-2- Ap- proved System Key AES-256 Key Internally generated [SP800-133] Plaintext in secure memory Module zeroization Confidentiality of CSPs on internal HSM’s memory All Batch Key Never generated API call: Input in plaintext shares Never output Not persistently stored -API call -Remove power Set up the SCP03 secure channel in a new smart cards’ batch AES -256 Master Key Internally generated [SP800-133] Plaintext in secure memory Module zeroization Derive CMM AES ENCRYPTION KEY Key and CMM AES MAC KEY Key Old AES -256 Master Key Former AES -256 Master Key Never input -API call -Module zeroization Translation Realsec Non proprietary 24 Revision: 12.11.3642 Date: 14/11/2018 Table 2.6: CSPs and other Protected Information (continued) CSP Type Generation Input Output Storage Zeroization Use Mode CMM AES ENCRYP- TION KEY Key AES-256 Key Derived from AES -256 Master Key [SP800-108] Never input Never output Not persistently stored -API call -Remove power Confidentiality of CSPs outside of HSM All CMM AES MAC KEY Key Authenticity of CSPs outside of HSM Old CMM AES ENCRYP- TION KEY Key Derived from Old AES -256 Master Key [SP800-108] Remove power Translation Old CMM AES MAC KEY Key AES Enc Key Derived from AES-256 Wrap Key [SP800-108] Confidentiality of wrapped keys AES Auth Key Authenticity of wrapped keys Realsec Non proprietary 25 Revision: 12.11.3642 Date: 14/11/2018 Table 2.6: CSPs and other Protected Information (continued) CSP Type Generation Input Output Storage Zeroization Use Mode DSA Domain Param- eters DSA L=2048, N=224 L=2048, N=256 L=3072, N=256 domain parameters API call: Generated [FIPS186-4] API call: Unwrapped [SP800-38F] API call: Wrapped [SP800-38F] Not persistently stored Remove power DSA Key Pair generation All DSA Key Pair DSA L=2048, N=224 L=2048, N=256 L=3072, N=256 keys Signature: generation verification ECDSA Key Pair ECDSA P-224, -256, -384, -521 K-233, 283, -409, -571 B-233, -283, -409, -571 keys Signature: generation verification RSA Key Pair RSA e=fermat4, M=2048 e=fermat4, M=3072 e=fermat4, M=4096 keys Signature: generation verification RSA Encap- sulation Key Pair Encapsulation Unencapsulation Smart Card PIN 8-byte string Never generated Input in plaintext Never output Not persistently stored -API call -Remove power Smart card access CO secret 33-byte string Internal generation Input in plaintext shares Output in plaintext shares Plaintext in secure memory Module zeroization Crypto Officer authentication Realsec Non proprietary 26 Revision: 12.11.3642 Date: 14/11/2018 Table 2.6: CSPs and other Protected Information (continued) CSP Type Generation Input Output Storage Zeroization Use Mode User password 8-byte string Never generated Input in plaintext Never output Plaintext in secure memory -API call -Module zeroization User authentication All Custodian password 24-byte string Internal generation Output in plaintext Custodian authentication CTR DRBG Entropy Input 48-byte array Never input Never output Not persistently stored -When used -Remove power Random data generation CTR DRBG Seed CTR DRBG V Value 16-byte array Remove power CTR DRBG Key AES-256 Key Realsec Non proprietary 27 Revision: 12.11.3642 Date: 14/11/2018 2.3 Module Interfaces The Cryptosec Dekaton is classified as a multi-chip embedded module for NIST FIPS PUB 140-2 purposes. The NIST FIPS PUB 140-2 cryptographic boundary is defined by the perimeter of the protection covers. The battery system is excluded from the security requirements of NIST FIPS PUB 140-2. The Cryptosec Dekaton is accessible only through well-defined interfaces. Note: In the following enumeration, the texts between brackets refer a component on the Cryptosec Dekaton PCB. Note: In the following figures, the yellow squares identify the elements that give access to each physical port. The Cryptosec Dekaton has several physical ports: 1. External battery port: The purpose of this port is to provide power to the Cryptosec Dekaton in absence of power through the PCIe 8x standard fingers. This power is used for for the retention and protection of the internally stored data. This port is accessible to the User by means of: • AA Battery holder (X9). • External battery connector (X5). Physically it is conformed by the following nets: • VBat. • DGND. Figure 2.3: External battery port Access B A T T E R Y H O L D E R E X T E R N A L B A T T E R Y C O N N E C T O R C R Y P T OGR A P H I C B OU N D A R Y Realsec Non proprietary 28 Revision: 12.11.3642 Date: 14/11/2018 2. PCIe 8x port: The purpose of this port is to provide communication with a host system through a PCI Express interface. This port is accessible by means of the PCIe 8x standard fingers (X2). Physically it is conformed by the following nets: Table 2.7: PCIe 8x standard fingers Pin Assignment Pin Side B Net Note Side A Net Note 1 +12V PCIe +12V /PRSNT1 PCIe.PRSNT1 2 +12V PCIe +12V +12V PCIe +12V 3 +12V PCIe +12V +12V PCIe +12V 4 GND DGND GND DGND 5 SMCLK N/C JTAG2 N/C 6 SMDAT N/C JTAG3 N/C 7 GND N/C JTAG4 N/C 8 +3V3 N/C JTAG5 N/C 9 JTAG1 N/C +3V3 N/C 10 3V3aux N/U +3V3 N/C 11 /WAKE N/C /PERST PCIe./PERST Key Key 12 RSVD N/C GND DGND 13 GND DGND REFCLK+ PCIe.CLK P 14 PET0 P PCIe.RX0 P REFCLK- PCIe.CLK N 15 PET0 N PCIe.RX0 N GND DGND 16 GND DGND PER0 P PCIe.TX0 P 17 /PRSNT2 N/C PER0 N PCIe.TX0 N 18 GND DGND GND DGND 19 PET1 P PCIe.RX1 P RSVD 20 PET1 N PCIe.RX1 N GND DGND 21 GND DGND PER1 P PCIe.TX1 P 22 GND DGND PER1 N PCIe.TX1 N 23 PET2 P PCIe.RX2 P GND DGND 24 PET2 N PCIe.RX2 N GND DGND 25 GND DGND PER2 P PCIe.TX2 P 26 GND DGND PER2 N PCIe.TX2 N 27 PET3 P PCIe.RX3 P GND DGND 28 PET3 N PCIe.RX3 N GND DGND 29 GND DGND PER3 P PCIe.TX3 P 30 RSVD N/C PER3 N PCIe.TX3 N 31 /PRSNT2 N/C GND DGND 32 GND DGND RSVD N/C 33 PET4 P PCIe.RX4 P RSVD N/C 34 PET4 N PCIe.RX4 N GND DGND 35 GND DGND PER4 P PCIe.TX4 P 36 GND DGND PER4 N PCIe.TX4 N 37 PET5 P PCIe.RX5 P GND DGND Realsec Non proprietary 29 Revision: 12.11.3642 Date: 14/11/2018 Table 2.7: PCIe 8x standard fingers Pin Assignment (continued) Pin Side B Net Note Side A Net Note 38 PET5 N PCIe.RX5 N GND DGND 39 GND DGND PER5 P PCIe.TX5 P 40 GND DGND PER5 N PCIe.TX5 N 41 PET6 P PCIe.RX6 P GND DGND 42 PET6 N PCIe.RX6 N GND DGND 43 GND DGND PER6 P PCIe.TX6 P 44 GND DGND PER6 N PCIe.TX6 N 45 PET7 P PCIe.RX7 P GND DGND 46 PET7 N PCIe.RX7 N GND DGND 47 GND DGND PER7 P PCIe.TX7 P 48 /PRSNT2 PCIe./PRSNT1 PER7 N PCIe.TX7 N 49 GND DGND GND DGND Figure 2.4: PCIe 8x standard fingers Access P C I e x 4 P C I E X P R E S Sx 8F I N G E R S C R Y P T OGR A P H I C B OU N D A R Y 3. Gigabit Ethernet ports: The purpose of these ports is to provide communication with remote systems through two LAN interfaces. These ports are accessible by means of the Ethernet connectors (X1). The Gigabit Ethernet 0 port is physically conformed by the following nets or buses: • +3V3 PS. • +1V8 PS. • +1V0 PS. • RGMII 0. • PS MDC Realsec Non proprietary 30 Revision: 12.11.3642 Date: 14/11/2018 • PS MDIO • /ETH RST • RST PHY CTRL The Gigabit Ethernet 1 port is physically conformed by the following nets or buses: • +3V3 PS. • +1V8 PS. • +1V0 PS. • RGMII 1. • PS MDC • PS MDIO • /ETH RST • RST PHY CTRL Figure 2.5: Gigabit Ethernet ports Access E T H E R N E T E T H E R N E T C O N N E C T O R S C R Y P T OGR A P H I C B OU N D A R Y 4. UART ports: The purpose of these ports is to provide communication with close systems through two UART interfaces. These ports are accessible by means of the Serial connector (X33) that embeds two RS-232 null modem ports and the USB Target connector (X4) that holds a USB target port. Note: The UART 1 port is only accessible through the USB Target connector. The UART 0 port is physically conformed by the following nets: • +3V3 PL. • DGND. • UART0 232 TX. Realsec Non proprietary 31 Revision: 12.11.3642 Date: 14/11/2018 • UART0 232 RX. The UART 1 port is physically conformed by the following nets: • +3V3 PL. • +5V0 PS. • +1V8 PS. • DGND. • UART1 232 TX. • UART1 232 RX. • UART1 USB TX. • UART1 USB RX. Figure 2.6: UART ports Access U A R T S E R I A L C O N N E C T O R C R Y P T OGR A P H I C B OU N D A R Y 5. USB Host port: The purpose of this port is to provide communication with USB-target systems. This port is accessible by means of the USB Host connector (X3) or the USB Host pins (X36). Note: The USB Host port is only used during product installation and upgrade. Physically it is conformed by the following nets or buses: • +5V0 PS. • +1V8 PS. • ULPI. • RST USB CTRL. • /USB RST. Realsec Non proprietary 32 Revision: 12.11.3642 Date: 14/11/2018 Figure 2.7: USB Host port Access U S BH O S T U S BH O S T C O N N E C T O R U S BH O S TP I N S C R Y P T OGR A P H I C B OU N D A R Y 6. Fan port: The purpose of this port is to connect a fan to provide forced heat evacuation if needed. This port is accessible by means of the Fan connector (X34). Physically it is conformed by the following nets: • PCIe +12V. • PWM CTRL. Figure 2.8: Fan port Access F A N F A N C O N N . C R Y P T OGR A P H I C B OU N D A R Y 7. Tamper port: Realsec Non proprietary 33 Revision: 12.11.3642 Date: 14/11/2018 The purpose of this port is to force the activation of the active tamper penetration mech- anism. This port is accessible by means of the Tamper Switch (S2). Physically it is conformed by the following net: • MESH3 6. Figure 2.9: Tamper port Access T A MP E R T A MP E R S WI T C H C R Y P T OGR A P H I C B OU N D A R Y 8. Power Present port: The purpose of this port is to evidence the presence of power through the PCIe +12V signal on the PCIe 8x port. This port is accessible by means of the Power Present LED (H1). Physically it is conformed by the following nets: • PCIe +12V. • DGND. Realsec Non proprietary 34 Revision: 12.11.3642 Date: 14/11/2018 Figure 2.10: Power Present port Access P O WE RP R E S E N T C R Y P T OGR A P H I C B OU N D A R Y 9. Currently Unsupported port: The purpose of this port is reserved for future use. This port is accessible by means of the Currently Unsupported LED (H3). Physically it is conformed by the following nets: • +3V3 PS. • PL LED. • DGND. Figure 2.11: Currently Unsupported port Access U N S U P P O R T E D C R Y P T OGR A P H I C B OU N D A R Y Realsec Non proprietary 35 Revision: 12.11.3642 Date: 14/11/2018 10. Power OK port: The purpose of this port is to evidence that the Cryptosec Dekaton is properly powered from the PCIe +12V signal on the PCIe 8x port. This port is accessible by means of the Power OK LED (H4). Physically it is conformed by the following nets: • +3V3 PS. • POWER OK. • DGND. Figure 2.12: Power OK port Access C R Y P T OGR A P H I C B OU N D A R Y 11. DDR3 Zeroization Done port: The purpose of this port is to evidence that the DDR3 RAM of the Cryptosec Dekaton is properly zeroized. This port is accessible by means of the DDR3 Zeroization Done LED (H6). Physically it is conformed by the following nets: • +3V3 UCD9090. • PMBCTRL1. • DGND. Realsec Non proprietary 36 Revision: 12.11.3642 Date: 14/11/2018 Figure 2.13: DDR3 Zeroization Done port Access C R Y P T OGR A P H I C B OU N D A R Y The Cryptosec Dekaton has several high-level logical interfaces: 1. Machine Interface: The Machine Interface is intended to communicate with other systems. The User services and some of the Unauthenticated services are provided through this interface. The API for this interface is described in 2.4.2 and in 2.4.3. The mapping of this interface to the NIST FIPS PUB 140-2 interfaces is as follows: • NIST FIPS PUB 140-2 Data Input Interface: Each of the inputs of the given service. • NIST FIPS PUB 140-2 Data Output Interface: Each of the outputs of the given service. • NIST FIPS PUB 140-2 Control Interface: The name of the service. • NIST FIPS PUB 140-2 Status Interface: The return code of the service. The Machine Interface is mapped to the physical ports as follows: • PCIe 8x port with the exception of the PCIe +12V node. • Gigabit Ethernet ports. 2. Human Interface: The Human Interface is intended to communicate with operators. The Crypto Officer services and some of the Unauthenticated services are provided through this interface. Also, some of the User services provide printed output through this interface. This communication can be achieved in different forms. Each of these forms imply a different interface: Realsec Non proprietary 37 Revision: 12.11.3642 Date: 14/11/2018 • Trusted Path: Implements the Cryptosec Dekaton console. It is implemented as an SSH connection, to secure plaintext security-related information flow. A public key is provided to the Cryptosec Dekaton during its initialization in order to setup this connection. The API for this interface is described in 2.4.1 and in 2.4.3. The Trusted Path goes from the cryptographic boundary of the HSM to a trusted IT element that allows the operator interaction, based on a text console and a keyboard. The SSH connection is slightly different from the usual SSH. There is a single user allowed to connect to the HSM and there is a single console available. The user name used for connecting to the console is “remote” and is authenticated using public key cryptography. When the “remote” user is authenticated, the console is detached from the current session (if any) and attached to the newly created session. Before attaching the console to the newly created SSH session, the system is logged out so the console is in an unauthenticated state when the SSH session is created. The operator may then authenticate on the console using his smart cards and providing the needed PINs to unblock the smart card. From a cryptographic point of view, the SSH server embedded in the HSM has a key pair and the user has another key pair: – The SSH server key pair is used to securely identify and authenticate the HSM. This key pair is created during the HSM initialization, when its public key hash is provided to the operator. The private key is stored encrypted on NAND Flash using the System Key. – The SSH user key pair is used to identify the user “remote” on the system. During initialization, the Crypto Officer must provide the public key for the “remote” user and securely store the corresponding private key. Both key pairs are P-521 ECDSA keys. Both plaintext security-related information and non-security-related information enter and leave the Cryptosec Dekaton Trusted Path. In order to distinguish appropriately between them, two logical interfaces are defined to conform the Trusted Path: – Non-CSP Interface: Implements the non-security-related information flow over the Cryptosec Dekaton console. The mapping of this interface to the NIST FIPS PUB 140-2 interfaces is as follows: ∗ NIST FIPS PUB 140-2 Data Input Interface: Each of the non-security-related inputs of the given service. ∗ NIST FIPS PUB 140-2 Data Output Interface: Each of the non-security-related outputs of the given service. ∗ NIST FIPS PUB 140-2 Control Interface: The name of the service. ∗ NIST FIPS PUB 140-2 Status Interface: The return code of the service. – CSP Interface: Implements the security-related information flow over the Cryptosec Dekaton con- sole. The mapping of this interface to the NIST FIPS PUB 140-2 interfaces is as follows: ∗ NIST FIPS PUB 140-2 Data Input Interface: Each of the security-related inputs of the given service. Realsec Non proprietary 38 Revision: 12.11.3642 Date: 14/11/2018 ∗ NIST FIPS PUB 140-2 Data Output Interface: Each of the security-related outputs of the given service. The mapping implies that the Non-CSP Interface and the CSP Interface share the Trusted Path. The Trusted Path is mapped to the physical ports as follows: – PCIe 8x port with the exception of the PCIe +12V node. – Gigabit Ethernet ports. Note: To configure the Trusted Path: Connect one of the Ethernet ports of the Cryp- tosec Dekaton to the Ethernet port of the SSH client device. The device’s Ethernet port is to be configured as 169.254.1.5/30. A key is to be used to establish the SSH connection. It can be generated as shown: ssh-keygen -t ecdsa -b 521 -f ssh client.key -C "Your comment here" The connection is to be opened as follows: ssh -i ssh client.key remote@169.254.1.2 Note: ssh client.key.pub is to be provided to the Cryptosec Dekaton during initial- ization through the serial console. • Printer Interface: Implements the printing facilities of the Cryptosec Dekaton. In NIST FIPS PUB 140-2-Approved mode, the printing is restricted to CSPs, i. e. symmetric key shares and banking PINs. Due to its nature, this interface presents no API. Instead, some of the services asso- ciated to other interfaces generate output through this interface. This interface is mapped to the NIST FIPS PUB 140-2 Data Output Interface: Each of the outputs of the given service that are to be produced through this interface. The Printer Interface is mapped to the UART 0 port. • Serial Interface: Implements status indicators during the power-up and power-down of the Cryptosec Dekaton. Due to its nature, this interface presents no API. This interface is mapped to the NIST FIPS PUB 140-2 Status Interface. The Serial Interface is mapped to the UART 1 port. • Physical Interface: Implements the manual controls and physical status indicators. Due to its nature, this interface presents no API. The mapping of this interface to the NIST FIPS PUB 140-2 interfaces is as follows: – NIST FIPS PUB 140-2 Control Interface: The attack emulation request. – NIST FIPS PUB 140-2 Status Interface: ∗ The power supply indicator. ∗ The power OK indicator. ∗ The DDR3 zeroization indicator. The Physical Interface is mapped to the physical ports as follows: – Tamper port. Realsec Non proprietary 39 Revision: 12.11.3642 Date: 14/11/2018 – Power Present port. – Power OK port. – DDR3 Zeroization Done port. 3. Power Interface: The Power Interface is intended to provide electrical power and to evacuate heat. Due to its nature, this interface presents no API. The mapping of this interface to the NIST FIPS PUB 140-2 interfaces is as follows: • NIST FIPS PUB 140-2 Power Interface: The power supplies. • NIST FIPS PUB 140-2 Status Interface: The fan control. The Power Interface is mapped to the physical ports as follows: • External battery port. • The following nodes of PCIe 8x port: – PCIe +12V. – DGND. • Fan port. The physical ports connected to the logical interfaces are under sole control of the logical in- terfaces, they are logically disconnected from other modules of the Cryptosec Dekaton. The logical interfaces present a well defined API to be accessed from other modules of the Cryptosec Dekaton. This scheme isolates both physically and logically the output data path from the inter- nal processes of the Cryptosec Dekaton, and in particular from the circuitry and processes that perform key generation, manual key entry and key zeroization. There is not a maintenance interface. To perform physical maintenance, the battery has to be replaced with a new one every 4 years. This operations is to be made by a Crypto Officer. Every sensitive information that is entered to the Cryptosec Dekaton in plain-text form is entered through the Trusted Path. Every sensitive information that leaves the module in plain-text form is extracted through the Trusted Path or the Printer Interface. A trusted SSH client system must be connected to the Gigabit Ethernet ports. A trusted printer can be connected to the UART 0 port. 2.4 Roles and Services The Cryptosec Dekaton performs identity-based authentication. The role of an operator is as- signed when the operator is created. The roles supported by the Cryptosec Dekaton are: • Unauthenticated: for those services available before any authentication. Realsec Non proprietary 40 Revision: 12.11.3642 Date: 14/11/2018 • User: User role as defined in [FIPS140-2, AS03.03]. • Crypto Officer: Crypto Officer role as defined in [FIPS140-2, AS03.03]. Aside from them, there are two operators that are double authentication factors associated to the Crypto Officer role: • Custodian: Is responsible of the input, the output and the protection of symmetric keys shares. • Master Keys Holder: Is responsible of the input, the output and the protection of Master Keys Cards. The unauthenticated services do not provide any security relevant functionality and they are not only available for the Unauthenticated role, but for the Crypto Officer role through the Human Interface (except the Crypto Officer login service), and for the User role through the Machine Interface. The custodians do not have any specific services. They only take part in processes started by the Crypto Officer when required. The Master Key Holders do not have any specific services. They only take part in processes started by the Crypto Officer when required. Note: All of the services apply to all of the modes of operation, Approved (NIST FIPS PUB 140-2-Approved) and Non-Approved (PCI PTS HSM v2.0-Approved and Non-Approved). Note: When the services are executed in Non-Approved modes, they are considered “non- compliant”. 2.4.1 Crypto Officer Role Note: Most of the services invoked from the Human Interface do not present an explicit return code when successfully executed. In such case, the absence of error indication is to be interpreted as an indication of its success. The Crypto Officer services are invoked from the Human Interface: Table 2.8: Crypto Officer Services from the Human Interface Service Description/Access and CSP Asymmetric key man- agement Generate, import and export asymmetric keys. Read access: SSH Key, System Key Write access: RSA Public Key, RSA Encapsulation Public Key Authenticated configu- ration Provide security-relevant module configuration and management. Read access: SSH Key, System Key Realsec Non proprietary 41 Revision: 12.11.3642 Date: 14/11/2018 Table 2.8: Crypto Officer Services from the Human Interface (continued) Service Description/Access and CSP Custodian management Custodian creation, modification and deletion. Read access: SSH Key, System Key Write access: Custodian password Read/Write access: CTR DBGR Entropy Input, CTR DBGR V Value, CTR DBGR Key, CTR DBGR Seed Log management System log management. Read access: SSH Key, System Key Master Keys manage- ment Master Keys generation, import and export. Read access: SSH Key, System Key, Smart card PIN Write access: CMM AES ENCRYPTION KEY Key, CMM AES MAC - KEY Key, Old CMM AES ENCRYPTION KEY Key, Old CMM AES - MAC KEY Key Read/Write access: AES-256 Master Key, Old AES-256 Master Key, CTR DBGR Entropy Input, CTR DBGR V Value, CTR DBGR Key, CTR DBGR Seed Card PIN management Card PIN configuration, generation, printing, translation and verifica- tion. Decimalization table management. Read access: SSH Key, System Key, CMM AES ENCRYPTION KEY Key, CMM AES MAC KEY Key Printing configuration Printer port and printer strings configuration. Not accessible in NIST FIPS PUB 140-2-Approved mode. Read access: SSH Key, System Key System smart cards management System smart cards management. Read access: SSH Key, System Key Write access: Old SCCK Key Read/Write access: SCCK Key, Batch Key, CTR DBGR Entropy Input, CTR DBGR V Value, CTR DBGR Key, CTR DBGR Seed Symmetric key manage- ment Generate, import, export and delete symmetric keys. Read access: SSH Key, System Key, CMM AES ENCRYPTION KEY Key, CMM AES MAC KEY Key, Custodian password Read/Write access: AES Encryption Key, AES CMAC Key, AES HMAC Key, AES GCM/GMAC Key, AES Wrap Key, TDES (3 key) Encryption Key, TDES (3 key) CMAC Key, TDES (3 key) HMAC Key, CTR DBGR Entropy Input, CTR DBGR V Value, CTR DBGR Key, CTR DBGR Seed User management User creation, modification and deletion. Read access: SSH Key, System Key Read/Write access: User password 2.4.2 User Role The User services are invoked from the Machine Interface: Realsec Non proprietary 42 Revision: 12.11.3642 Date: 14/11/2018 Table 2.9: User Services from the Machine Interface Service Description/Access and CSP Asymmetric key man- agement Generate, import and export asymmetric keys. Read access: CMM AES ENCRYPTION KEY Key, CMM AES MAC - KEY Key Write access: DSA Private Key, DSA Public Key, ECDSA Private Key, ECDSA Public Key Read/Write access: AES Enc Key, AES Auth Key, CTR DBGR Entropy Input, CTR DBGR V Value, CTR DBGR Key, CTR DBGR Seed, RSA Private Key, RSA Encapsulation Private Key, RSA Public Key, RSA Encapsulation Public Key, DSA Domain Parameters Card validation code Generate or verify card validation codes. Read access: System Key, CMM AES ENCRYPTION KEY Key, CMM AES MAC KEY Key Read/Write access: AES Enc Key, AES Auth Key Authenticated configu- ration Provide security-relevant module configuration and management. Read access: CMM AES ENCRYPTION KEY Key, CMM AES MAC - KEY Key, RSA Private Key Read/Write access: AES Enc Key, AES Auth Key EMV Generate or verify EMV transaction authorization values. Generate EMV security scripts. Read access: System Key, CMM AES ENCRYPTION KEY Key, CMM AES MAC KEY Key, TDES (3 key) Encryption Key, TDES (3 key) CMAC Key Read/Write access: AES Enc Key, AES Auth Key Key encapsulation Perform key transport using asymmetric keys. Read access: System Key, CMM AES ENCRYPTION KEY Key, CMM AES MAC KEY Key, RSA Encapsulation Public Key, RSA Pri- vate Key, RSA Encapsulation Private Key, RSA Public Key Read/Write access: AES Enc Key, AES Auth Key, AES HMAC Key, AES Encryption Key, AES CMAC Key, AES GCM/GMAC Key, AES Wrap Key, CTR DBGR Entropy Input, CTR DBGR V Value, CTR - DBGR Key, CTR DBGR Seed, TDES (3 key) Encryption Key, TDES (3 key) CMAC Key, TDES (3 key) HMAC Key Keyed hash Generate or verify data integrity with HMAC. Read access: System Key, CMM AES ENCRYPTION KEY Key, CMM AES MAC KEY Key, TDES (3 key) HMAC Key, AES HMAC Key Read/Write access: AES Enc Key, AES Auth Key Log management System log management. Read access: CMM AES ENCRYPTION KEY Key, CMM AES MAC - KEY Key Read/Write access: AES Enc Key, AES Auth Key Symmetric digest Generate or verify data integrity with CMAC. Realsec Non proprietary 43 Revision: 12.11.3642 Date: 14/11/2018 Table 2.9: User Services from the Machine Interface (continued) Service Description/Access and CSP Read access: System Key, CMM AES ENCRYPTION KEY Key, CMM AES MAC KEY Key, TDES (3 key) CMAC Key, AES CMAC Key Read/Write access: AES Enc Key, AES Auth Key Master Keys informa- tion Master Keys information. Card PIN management Card PIN configuration, generation, printing, translation and verifica- tion. Decimalization table management. Read access: System Key, CMM AES ENCRYPTION KEY Key, CMM AES MAC KEY Key, TDES (3 key) Encryption Key Read/Write access: AES Enc Key, AES Auth Key, CTR DBGR Entropy Input, CTR DBGR V Value, CTR DBGR Key, CTR DBGR Seed Printing configuration Printer port and printer strings configuration. Not accessible in NIST FIPS PUB 140-2-Approved mode. Random number gener- ation Provide random data. Read/Write access: CTR DBGR Entropy Input, CTR DBGR V Value, CTR DBGR Key, CTR DBGR Seed Digital signature Generate or verify digital signatures. Read access: CMM AES ENCRYPTION KEY Key, CMM AES MAC - KEY Key, RSA Private Key, RSA Public Key, DSA Private Key, DSA Public Key, ECDSA Private Key, ECDSA Public Key Read/Write access: AES Enc Key, AES Auth Key, CTR DBGR Entropy Input, CTR DBGR V Value, CTR DBGR Key, CTR DBGR Seed Encryption/Decryption Perform encryption and decryption. Read access: System Key, CMM AES ENCRYPTION KEY Key, CMM AES MAC KEY Key, TDES (3 key) Encryption Key, AES En- cryption Key, AES GCM/GMAC Key Read/Write access: AES Enc Key, AES Auth Key Symmetric key manage- ment Generate, import, export and delete symmetric keys. Read access: System Key, CMM AES ENCRYPTION KEY Key, CMM AES MAC KEY Key, Old CMM AES ENCRYPTION KEY Key, Old CMM AES MAC KEY Key Read/Write access: AES Enc Key, AES Auth Key, CTR DBGR En- tropy Input, CTR DBGR V Value, CTR DBGR Key, CTR DBGR Seed, TDES (3 key) Encryption Key, TDES (3 key) CMAC Key, TDES (3 key) HMAC Key, AES Encryption Key, AES CMAC Key, AES HMAC Key, AES GCM/GMAC Key, AES Wrap Key User information User information. Wallet and transport certificate management Generate TIBC or Advantis wallet and transport certificates. Not acces- sible in NIST FIPS PUB 140-2-Approved mode. Key wrapping Perform key transport using symmetric keys. Read access: System Key, CMM AES ENCRYPTION KEY Key, CMM AES MAC KEY Key Realsec Non proprietary 44 Revision: 12.11.3642 Date: 14/11/2018 Table 2.9: User Services from the Machine Interface (continued) Service Description/Access and CSP Read/Write access: AES Enc Key, AES Auth Key, AES Wrap Key, TDES (3 key) Encryption Key, TDES (3 key) CMAC Key, TDES (3 key) HMAC Key, CTR DBGR Entropy Input, CTR DBGR V Value, CTR - DBGR Key, CTR DBGR Seed, AES Encryption Key, AES CMAC Key, AES HMAC Key, AES GCM/GMAC Key, RSA Private Key, RSA Public Key, DSA Private Key, DSA Public Key, DSA Domain Parameters 2.4.3 Unauthenticated Services Machine Interface The following Unauthenticated services are invoked from the Machine Interface: Table 2.10: Unauthenticated Services from the Machine Interface Service Description/Access and CSP Unauthenticated config- uration Provide non security-relevant module configuration and management. Read access: User password Read/Write access: CTR DBGR Entropy Input, CTR DBGR V Value, CTR DBGR Key, CTR DBGR Seed Message digest Generate message digest. Information Provide module information. Note: The document CryptosecDekatonUserGuide (Revision: 12.11.3642 Date: 14/11/2018) contains detailed information on the Unauthenticated Services invoked from the Machine Inter- face. To obtain this document, please contact Realia Technologies, S.L. Human Interface Note: Most of the services invoked from the Human Interface do not present an explicit return code when successfully executed. In such case, the absence of error indication is to be interpreted as an indication of its success. The following Unauthenticated services are invoked from the Human Interface: Table 2.11: Unauthenticated Services from the Human Interface Service Description/Access and CSP Unauthenticated config- uration Provide non security-relevant module configuration and management. Read access: SSH Key, System Key, Smart card PIN, Crypto Officer secret Realsec Non proprietary 45 Revision: 12.11.3642 Date: 14/11/2018 Table 2.11: Unauthenticated Services from the Human Interface (continued) Service Description/Access and CSP Write access: CMM AES ENCRYPTION KEY Key, Old CMM AES - ENCRYPTION KEY Key, CMM AES MAC KEY Key, Old CMM - AES MAC KEY Key Information Provide module information. Read access: SSH Key, System Key Self test Perform On Demand Self Tests. Read access: SSH Key, System Key Zeroization Perform the module zeroization using the Tamper Switch. Write access: AES Encryption Key, AES CMAC Key, AES HMAC Key, AES GCM/GMAC Key, AES Wrap Key, TDES (3 key) Encryption Key, TDES (3 key) CMAC Key, TDES (3 key) HMAC Key, System Key, SCCK Key, Old SCCK Key, Batch Key, AES-256 Master Key, Old AES-256 Master Key, CMM AES ENCRYPTION KEY Key, Old CMM AES ENCRYPTION KEY Key, CMM AES MAC KEY Key, Old CMM AES MAC KEY Key, AES Enc Key, AES Auth Key, DSA Do- main Parameters, DSA Private Key, DSA Public Key, ECDSA Private Key, ECDSA Public Key, RSA Private Key, RSA Public Key, RSA En- capsulation Private Key, RSA Encapsulation Public Key, Smart Card PIN, Crypto Officer secret, User password, Custodian password, CTR - DRBG Entropy Input, CTR DRBG V Value, CTR DRBG Key, CTR - DRBG Seed Note: The document CryptosecDekatonAdministratorGuide (Revision: 12.11.3642 Date: 14/11/2018) contains detailed information on the Unauthenticated Services invoked from the Human Inter- face. To obtain this document, please contact Realia Technologies, S.L. 2.5 Physical Security The physical security mechanisms consist not only on the metallic covers and the epoxy resin. But it also extends to the module design as a whole: the buses are physically isolated. The metallic covers are made of aluminum and they cover both sides of the PCB, delimiting perfectly the cryptographic boundary. The space between them is completely filled with epoxy resin, making the module even more protected. The epoxy resin is opaque to the visible spectrum. 2.6 Self-Tests Self-Tests are formed by: • Power-up Self-Tests Realsec Non proprietary 46 Revision: 12.11.3642 Date: 14/11/2018 – Cryptographic Power-up Self-Tests AES.ECB.128 AES-128 encryption and decryption in ECB mode KAT. AES.ECB.192 AES-192 encryption and decryption in ECB mode KAT. AES.ECB.256 AES-256 encryption and decryption in ECB mode KAT. AES.CBC.128 AES-128 encryption and decryption in CBC mode KAT. AES.CBC.192 AES-192 encryption and decryption in CBC mode KAT. AES.CBC.256 AES-256 encryption and decryption in CBC mode KAT. AES.CTR.128 AES-128 encryption and decryption in CTR mode KAT. AES.CTR.192 AES-192 encryption and decryption in CTR mode KAT. AES.CTR.256 AES-256 encryption and decryption in CTR mode KAT. AES.CMAC.128.length0 AES-128-CMAC KAT. AES.CMAC.128.length16 AES-128-CMAC KAT. AES.CMAC.128.length20 AES-128-CMAC KAT. AES.CMAC.128.length64 AES-128-CMAC KAT. AES.CMAC.192.length0 AES-192-CMAC KAT. AES.CMAC.192.length16 AES-192-CMAC KAT. AES.CMAC.192.length20 AES-192-CMAC KAT. AES.CMAC.192.length64 AES-192-CMAC KAT. AES.CMAC.256.length0 AES-256-CMAC KAT. AES.CMAC.256.length16 AES-256-CMAC KAT. AES.CMAC.256.length20 AES-256-CMAC KAT. AES.CMAC.256.length64 AES-256-CMAC KAT. AES.CBCMAC.128.length16 AES-128-CBCMAC KAT. AES.CBCMAC.128.length64 AES-128-CBCMAC KAT. AES.CBCMAC.192.length16 AES-192-CBCMAC KAT. AES.CBCMAC.192.length64 AES-192-CBCMAC KAT. AES.CBCMAC.256.length16 AES-256-CBCMAC KAT. AES.CBCMAC.256.length64 AES-256-CBCMAC KAT. AES.GCM.128.aad=0,pt=0,tag=128 AES-128 encryption and decryption in GCM mode KAT. AES.GCM.128.aad=0,pt=512,tag=128 AES-128 encryption and decryption in GCM mode KAT. AES.GCM.128.aad=512,pt=0,tag=128 AES-128 encryption and decryption in GCM mode KAT. AES.GCM.128.aad=512,pt=512,tag=128 AES-128 encryption and decryption in GCM mode KAT. AES.GCM.128.aad=160,pt=480,tag=128 AES-128 encryption and decryption in GCM mode KAT. AES.GCM.128.aad=160,pt=480,tag=96 AES-128 encryption and decryption in GCM mode KAT. AES.GCM.192.aad=0,pt=0,tag=128 AES-192 encryption and decryption in GCM mode KAT. AES.GCM.192.aad=0,pt=512,tag=128 AES-192 encryption and decryption in GCM mode KAT. Realsec Non proprietary 47 Revision: 12.11.3642 Date: 14/11/2018 AES.GCM.192.aad=512,pt=0,tag=128 AES-192 encryption and decryption in GCM mode KAT. AES.GCM.192.aad=512,pt=512,tag=128 AES-192 encryption and decryption in GCM mode KAT. AES.GCM.192.aad=160,pt=480,tag=128 AES-192 encryption and decryption in GCM mode KAT. AES.GCM.192.aad=160,pt=480,tag=96 AES-192 encryption and decryption in GCM mode KAT. AES.GCM.256.aad=0,pt=0,tag=128 AES-256 encryption and decryption in GCM mode KAT. AES.GCM.256.aad=0,pt=512,tag=128 AES-256 encryption and decryption in GCM mode KAT. AES.GCM.256.aad=512,pt=0,tag=128 AES-256 encryption and decryption in GCM mode KAT. AES.GCM.256.aad=512,pt=512,tag=128 AES-256 encryption and decryption in GCM mode KAT. AES.GCM.256.aad=160,pt=480,tag=128 AES-256 encryption and decryption in GCM mode KAT. AES.GCM.256.aad=160,pt=480,tag=96 AES-256 encryption and decryption in GCM mode KAT. DES.ECB.SIMPLE.1 DES encryption and decryption in ECB mode KAT. DES.ECB.DOUBLE.1 TDES (2 key) encryption and decryption in ECB mode KAT. DES.ECB.TRIPLE.1 TDES (3 key) encryption and decryption in ECB mode KAT. DES.CBC.SIMPLE.1 DES encryption and decryption in CBC mode KAT. DES.CBC.DOUBLE.1 TDES (2 key) encryption and decryption in CBC mode KAT. DES.CBC.TRIPLE.1 TDES (3 key) encryption and decryption in CBC mode KAT. DES.ECB.TRIPLE.2 TDES (3 key) encryption and decryption in ECB mode KAT. DES.ECB.TRIPLE.3 TDES (3 key) encryption and decryption in ECB mode KAT. DES.CBC.TRIPLE.2 TDES (3 key) encryption and decryption in CBC mode KAT. DES.CBC.TRIPLE.3 TDES (3 key) encryption and decryption in CBC mode KAT. DES.CMAC.SIMPLE.1 DES-CMAC, KAT. DES.CMAC.DOUBLE.1 TDES (2 key)-CMAC, KAT. DES.CMAC.TRIPLE.1 TDES (3 key)-CMAC, KAT. DES.CMAC.TRIPLE.2 TDES (3 key)-CMAC, KAT. DES.CMAC.TRIPLE.3 TDES (3 key)-CMAC, KAT. DES.CMAC.TRIPLE.4 TDES (3 key)-CMAC, KAT. DES.CMAC.TRIPLE.5 TDES (3 key)-CMAC, KAT. DES.CMAC.TRIPLE.6 TDES (3 key)-CMAC, KAT. DES.CMAC.TRIPLE.7 TDES (3 key)-CMAC, KAT. DES.CMAC.TRIPLE.8 TDES (3 key)-CMAC, KAT. Realsec Non proprietary 48 Revision: 12.11.3642 Date: 14/11/2018 DSA.1024@64 DSA L=1024 N=160, KAT. Test over 64 bit cores. DSA.1024@256 DSA L=1024 N=160, KAT. Test over 256 bit cores. DSA.2048.224@64 DSA L=2048 N=224, KAT. Test over 64 bit cores. DSA.2048.224@256 DSA L=2048 N=224, KAT. Test over 256 bit cores. DSA.2048.256@64 DSA L=2048 N=256, KAT. Test over 64 bit cores. DSA.2048.256@256 DSA L=2048 N=256, KAT. Test over 256 bit cores. DSA.3072@64 DSA L=3072 N=256, KAT. Test over 64 bit cores. DSA.3072@256 DSA L=3072 N=256, KAT. Test over 256 bit cores. ECDSA.B163 ECDSA B163 KAT. ECDSA.B233 ECDSA B233 KAT. ECDSA.B283 ECDSA B283 KAT. ECDSA.B409 ECDSA B409 KAT. ECDSA.B571 ECDSA B571 KAT. ECDSA.P192@64 ECDSA P192 KAT. Test over 64 bit cores. ECDSA.P192@256 ECDSA P192 KAT. Test over 256 bit cores. ECDSA.P224@64 ECDSA P224 KAT. Test over 64 bit cores. ECDSA.P224@256 ECDSA P224 KAT. Test over 256 bit cores. ECDSA.P256@64 ECDSA P256 KAT. Test over 64 bit cores. ECDSA.P256@256 ECDSA P256 KAT. Test over 256 bit cores. ECDSA.P384@64 ECDSA P384 KAT. Test over 64 bit cores. ECDSA.P384@256 ECDSA P384 KAT. Test over 256 bit cores. ECDSA.P521@64 ECDSA P521 KAT. Test over 64 bit cores. ECDSA.P521@256 ECDSA P521 KAT. Test over 256 bit cores. ECDSA.K163@64 ECDSA K163 KAT. Test over 64 bit cores. ECDSA.K163@256 ECDSA K163 KAT. Test over 256 bit cores. ECDSA.K233@64 ECDSA K233 KAT. Test over 64 bit cores. ECDSA.K233@256 ECDSA K233 KAT. Test over 256 bit cores. ECDSA.K283@64 ECDSA K283 KAT. Test over 64 bit cores. ECDSA.K283@256 ECDSA K283 KAT. Test over 256 bit cores. ECDSA.K409@64 ECDSA K409 KAT. Test over 64 bit cores. ECDSA.K409@256 ECDSA K409 KAT. Test over 256 bit cores. ECDSA.K571@64 ECDSA K571 KAT. Test over 64 bit cores. ECDSA.K571@256 ECDSA K571 KAT. Test over 256 bit cores. ECDSA.BP160@64 ECDSA BP160 KAT. Test over 64 bit cores. ECDSA.BP160@256 ECDSA BP160 KAT. Test over 256 bit cores. ECDSA.BP192@64 ECDSA BP192 KAT. Test over 64 bit cores. ECDSA.BP192@256 ECDSA BP192 KAT. Test over 256 bit cores. ECDSA.BP224@64 ECDSA BP224 KAT. Test over 64 bit cores. ECDSA.BP224@256 ECDSA BP224 KAT. Test over 256 bit cores. ECDSA.BP256@64 ECDSA BP256 KAT. Test over 64 bit cores. ECDSA.BP256@256 ECDSA BP256 KAT. Test over 256 bit cores. ECDSA.BP320@64 ECDSA BP320 KAT. Test over 64 bit cores. ECDSA.BP320@256 ECDSA BP320 KAT. Test over 256 bit cores. Realsec Non proprietary 49 Revision: 12.11.3642 Date: 14/11/2018 ECDSA.BP384@64 ECDSA BP384 KAT. Test over 64 bit cores. ECDSA.BP384@256 ECDSA BP384 KAT. Test over 256 bit cores. ECDSA.BP512@64 ECDSA BP512 KAT. Test over 64 bit cores. ECDSA.BP512@256 ECDSA BP512 KAT. Test over 256 bit cores. ECDSA.BPT160@64 ECDSA BPT160 KAT. Test over 64 bit cores. ECDSA.BPT160@256 ECDSA BPT160 KAT. Test over 256 bit cores. ECDSA.BPT192@64 ECDSA BPT192 KAT. Test over 64 bit cores. ECDSA.BPT192@256 ECDSA BPT192 KAT. Test over 256 bit cores. ECDSA.BPT224@64 ECDSA BPT224 KAT. Test over 64 bit cores. ECDSA.BPT224@256 ECDSA BPT224 KAT. Test over 256 bit cores. ECDSA.BPT256@64 ECDSA BPT256 KAT. Test over 64 bit cores. ECDSA.BPT256@256 ECDSA BPT256 KAT. Test over 256 bit cores. ECDSA.BPT320@64 ECDSA BPT320 KAT. Test over 64 bit cores. ECDSA.BPT320@256 ECDSA BPT320 KAT. Test over 256 bit cores. ECDSA.BPT384@64 ECDSA BPT384 KAT. Test over 64 bit cores. ECDSA.BPT384@256 ECDSA BPT384 KAT. Test over 256 bit cores. ECDSA.BPT512@64 ECDSA BPT512 KAT. Test over 64 bit cores. ECDSA.BPT512@256 ECDSA BPT512 KAT. Test over 256 bit cores. MD5 MD5 KAT. RSA.SSA-PKCS1.2048.1@64 RSASSA-PKCS1-v1.5 with 2048-bit key KAT 1. Test over 64 bit cores. RSA.SSA-PKCS1.2048.1@256 RSASSA-PKCS1-v1.5 with 2048-bit key KAT 1. Test over 256 bit cores. RSA.SSA-PKCS1.2048.2@64 RSASSA-PKCS1-v1.5 with 2048-bit key KAT 2. Test over 64 bit cores. RSA.SSA-PKCS1.2048.2@256 RSASSA-PKCS1-v1.5 with 2048-bit key KAT 2. Test over 256 bit cores. RSA.SSA-PKCS1.3072.1@64 RSASSA-PKCS1-v1.5 with 3072-bit key KAT 1. Test over 64 bit cores. RSA.SSA-PKCS1.3072.1@256 RSASSA-PKCS1-v1.5 with 3072-bit key KAT 1. Test over 256 bit cores. RSA.SSA-PKCS1.3072.2@64 RSASSA-PKCS1-v1.5 with 3072-bit key KAT 2. Test over 64 bit cores. RSA.SSA-PKCS1.3072.2@256 RSASSA-PKCS1-v1.5 with 3072-bit key KAT 2. Test over 256 bit cores. RSA.SSA-PKCS1.4096.1@64 RSASSA-PKCS1-v1.5 with 4096-bit key KAT 1. Test over 64 bit cores. RSA.SSA-PKCS1.4096.1@256 RSASSA-PKCS1-v1.5 with 4096-bit key KAT 1. Test over 256 bit cores. RSA.SSA-PKCS1.4096.2@64 RSASSA-PKCS1-v1.5 with 4096-bit key KAT 2. Test over 64 bit cores. RSA.SSA-PKCS1.4096.2@256 RSASSA-PKCS1-v1.5 with 4096-bit key KAT 2. Test over 256 bit cores. RSA.SSA-PSS.2048.1@64 RSASSA-PSS with 2048-bit key KAT 1. Test over 64 bit cores. Realsec Non proprietary 50 Revision: 12.11.3642 Date: 14/11/2018 RSA.SSA-PSS.2048.1@256 RSASSA-PSS with 2048-bit key KAT 1. Test over 256 bit cores. RSA.SSA-PSS.2048.2@64 RSASSA-PSS with 2048-bit key KAT 2. Test over 64 bit cores. RSA.SSA-PSS.2048.2@256 RSASSA-PSS with 2048-bit key KAT 2. Test over 256 bit cores. RSA.SSA-PSS.3072.1@64 RSASSA-PSS with 3072-bit key KAT 1. Test over 64 bit cores. RSA.SSA-PSS.3072.1@256 RSASSA-PSS with 3072-bit key KAT 1. Test over 256 bit cores. RSA.SSA-PSS.3072.2@64 RSASSA-PSS with 3072-bit key KAT 2. Test over 64 bit cores. RSA.SSA-PSS.3072.2@256 RSASSA-PSS with 3072-bit key KAT 2. Test over 256 bit cores. RSA.SSA-PSS.4096.1@64 RSASSA-PSS with 4096-bit key KAT 1. Test over 64 bit cores. RSA.SSA-PSS.4096.1@256 RSASSA-PSS with 4096-bit key KAT 1. Test over 256 bit cores. RSA.SSA-PSS.4096.2@64 RSASSA-PSS with 4096-bit key KAT 2. Test over 64 bit cores. RSA.SSA-PSS.4096.2@256 RSASSA-PSS with 4096-bit key KAT 2. Test over 256 bit cores. RSA.ES-OAEP.2048.1@64 RSAES-OAEP with 2048-bit key KAT 1. Test over 64 bit cores. RSA.ES-OAEP.2048.1@256 RSAES-OAEP with 2048-bit key KAT 1. Test over 256 bit cores. RSA.ES-OAEP.2048.2@64 RSAES-OAEP with 2048-bit key KAT 2. Test over 64 bit cores. RSA.ES-OAEP.2048.2@256 RSAES-OAEP with 2048-bit key KAT 2. Test over 256 bit cores. RSA.ES-OAEP.3072.1@64 RSAES-OAEP with 3072-bit key KAT 1. Test over 64 bit cores. RSA.ES-OAEP.3072.1@256 RSAES-OAEP with 3072-bit key KAT 1. Test over 256 bit cores. RSA.ES-OAEP.3072.2@64 RSAES-OAEP with 3072-bit key KAT 2. Test over 64 bit cores. RSA.ES-OAEP.3072.2@256 RSAES-OAEP with 3072-bit key KAT 2. Test over 256 bit cores. RSA.ES-OAEP.4096.1@64 RSAES-OAEP with 4096-bit key KAT 1. Test over 64 bit cores. RSA.ES-OAEP.4096.1@256 RSAES-OAEP with 4096-bit key KAT 1. Test over 256 bit cores. RSA.ES-OAEP.4096.2@64 RSAES-OAEP with 4096-bit key KAT 2. Test over 64 bit cores. RSA.ES-OAEP.4096.2@256 RSAES-OAEP with 4096-bit key KAT 2. Test over 256 bit cores. Realsec Non proprietary 51 Revision: 12.11.3642 Date: 14/11/2018 RSA.generate.512@64 RSA 512-bit private key generation test. Test over 64 bit cores. RSA.generate.512@256 RSA 512-bit private key generation test. Test over 256 bit cores. RSA.generate.1024@64 RSA 1024-bit private key generation test. Test over 64 bit cores. RSA.generate.1024@256 RSA 1024-bit private key generation test. Test over 256 bit cores. RSA.generate.1536@64 RSA 1536-bit private key generation test. Test over 64 bit cores. RSA.generate.1536@256 RSA 1536-bit private key generation test. Test over 256 bit cores. RSA.generate.2048@64 RSA 2048-bit private key generation test. Test over 64 bit cores. RSA.generate.2048@256 RSA 2048-bit private key generation test. Test over 256 bit cores. RSA.generate.2560@64 RSA 2560-bit private key generation test. Test over 64 bit cores. RSA.generate.2560@256 RSA 2560-bit private key generation test. Test over 256 bit cores. RSA.generate.3072@64 RSA 3072-bit private key generation test. Test over 64 bit cores. RSA.generate.3072@256 RSA 3072-bit private key generation test. Test over 256 bit cores. RSA.generate.3584@64 RSA 3584-bit private key generation test. Test over 64 bit cores. RSA.generate.3584@256 RSA 3584-bit private key generation test. Test over 256 bit cores. RSA.generate.4096@64 RSA 4096-bit private key generation test. Test over 64 bit cores. RSA.generate.4096@256 RSA 4096-bit private key generation test. Test over 256 bit cores. SHA1 SHA1 KAT. SHA2.SHA224 SHA224 KAT. SHA2.SHA256 SHA256 KAT. SHA2.SHA384 SHA384 KAT. SHA2.SHA512 SHA512 KAT. SHA2.SHA512/224 SHA512/224 KAT. SHA2.SHA512/256 SHA512/256 KAT. Entropy source Entropy source test. PRNG CTRAES CTR DRBG health test. HMAC.SHA1.KS